Security Practices

How BudgetMeThis protects user information.

BudgetMeThis maintains documented security policies, supporting procedures, and an operational information security program that is reviewed and matured as the service grows. Verified accounts use phishing-resistant passkey MFA before private budget features are available.

Overview

Our commitment

BudgetMeThis is designed to help users organize budget, transaction, and planning information. We treat user account information, budget records, and financial data as confidential information and use administrative, technical, and operational controls to protect it.

This page summarizes the user-facing parts of our information security policy and procedures. Internal operational details, security response playbooks, and administrative procedures are maintained separately.

Accounts

User access

  • Users access BudgetMeThis through individual accounts.
  • Email verification is used before cloud sync features are enabled.
  • Verified users must complete passkey MFA before private budget data is available.
  • Password reset flows use limited-purpose reset links.
  • Administrative access is limited to authorized personnel with a business need.
Financial Data

Connected account handling

  • BudgetMeThis does not ask users to provide bank usernames or passwords directly to the site.
  • When connected financial account features are used, they are handled through secure provider flows such as Plaid Link.
  • Financial data is used to provide budgeting and account-related features requested by the user.
  • BudgetMeThis does not sell user financial data.
Data Use

Minimization and purpose

  • We collect and store information needed to operate the budgeting service.
  • We avoid collecting sensitive information that is not needed for the product.
  • Temporary migration, diagnostic, and support files are removed when they are no longer needed.
  • User data is used to provide, maintain, secure, and improve BudgetMeThis.
Protection

Security controls

  • The production website is served over HTTPS.
  • Passkeys use device-bound public key cryptography and browser-supported user verification.
  • Credentials, keys, and tokens are treated as restricted information.
  • Secrets are not intended to be exposed in browser-side code or public files.
  • Access to hosting, database, and administrative tools is limited to authorized administrators.
  • Application administrator functions require a current Microsoft Entra / Microsoft 365 admin sign-in.
  • Administrator access is reviewed and removed when it is no longer required.
Operations

Review and maintenance

  • Security procedures are reviewed as the site, vendors, integrations, and risks change.
  • Access to production systems is reviewed periodically.
  • BudgetMeThis uses a zero trust approach for administrator access: verify explicitly, limit access by role, and require reauthentication for privileged actions.
  • If administrator access is removed in Microsoft Entra / Microsoft 365, the user cannot complete new BudgetMeThis administrator sign-ins.
  • Security updates and important provider notices are reviewed as part of normal operations.
  • Changes to authentication, authorization, financial data, or database behavior receive additional review.
Response

Incident handling

  • Suspected security issues are investigated and documented.
  • Exposed credentials, keys, or tokens are revoked or rotated when needed.
  • Relevant logs and facts are preserved during incident review.
  • Affected users, vendors, or authorities are notified when required by law, contract, or platform rules.

Plaid and financial connections

How connected financial account features work

If BudgetMeThis offers connected financial account features, those connections are designed to use secure third-party provider flows. Users should not send bank passwords to BudgetMeThis support or enter bank credentials anywhere other than the secure connection flow shown by the provider.

Before connected financial account features are surfaced to a verified user, BudgetMeThis requires phishing-resistant passkey MFA for the account session.

BudgetMeThis protects provider credentials, access tokens, and account identifiers as restricted information. We do not publish those values, include them in public files, or intentionally log them in support records.

Questions

Security questions or reports

If you believe you found a security issue or need help with your BudgetMeThis account, contact the site administrator through the support channel provided by BudgetMeThis or Basic Ministries.

Last updated: October 11, 2026